The processes taking place in the electronic world leave many passive and active traces, respectively: technical information on the use of electronic devices and traces of actions taken by the direct user: photos, video recordings. It is shown that digital forensics covers computer hardware and their software, computer information, network technologies, mobile communication, and cloud technologies. It is indicated that the specificity of digital information determines the peculiarities of its search, detection and extraction in the form of investigative actions. When obtaining material evidence, there is often a need for their expert research. Examples of digital evidence are considered. It has been proven that compared to traditional evidence (e.g. paper documents, weapons, controlled substances, etc.), digital evidence creates unique difficulties in authentication due to the amount of data available, its speed (i.e. the speed with which it is created and transmitted), instability (that is, they can quickly disappear when overwritten or deleted), and vulnerability (that is, they can easily be manipulated, changed, or corrupted). International standards related to the handling of digital evidence are considered ISO / IEC 27037 Guidelines for the identification, collection, acquisition and preservation of evidence presented in digital form by the International Organization for Standardization. It is shown that digital forensics, along with its obvious advantages, has certain disadvantages.